# Invalid signature - python 3

**URL:** <https://devforum.zoom.us/t/invalid-signature-python-3/83251>\
**Category:** API and Webhooks\
**Created:** [February 16, 2023, 10:18am UTC](https://devforum.zoom.us/t/invalid-signature-python-3/83251 "2023-02-16T10:18:46Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![jovy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jovy/32/55248_2.png) [@jovy](https://devforum.zoom.us/u/jovy)\
**Post date:** [February 16, 2023, 10:18am UTC](https://devforum.zoom.us/t/invalid-signature-python-3/83251/1 "2023-02-16T10:18:46Z")

</div>

Hi there,

I have created a function to generate signatures using python 3, but I’m getting an invalid signature when I create a signature and try to join the meeting.

I have followed this link to create a signature but still not working,  
[generate signature](https://marketplace.zoom.us/docs/sdk/native-sdks/web/signature/)

please refer to the code below

```auto
import hashlib
import hmac
import base64
import time

def generateSignature(request):

    data = request.data
    print('data', data)

    meetingNumber = data.get('meetingNumber', None)
    role = data.get('role', None)

    print('meetingNumber', meetingNumber, role)

    if not meetingNumber:
        return {
            'code': 400,
            'msg': 'bad request'
        }

    ts = int(round(time() * 1000)) - 30000
    msg = SDK_KEY + str(meetingNumber) + str(ts) + str(role)
    message = base64.b64encode(bytes(msg, 'utf-8'))
    secret = bytes(SDK_SECRETE, 'utf-8')
    hash = hmac.new(secret, message, hashlib.sha256)
    hash = base64.b64encode(hash.digest())
    hash = hash.decode("utf-8")
    tmpString = "%s.%s.%s.%s.%s" % (SDK_KEY, str(meetingNumber), str(ts), str(role), hash)
    signature = base64.b64encode(bytes(tmpString, "utf-8"))
    signature = signature.decode("utf-8")
    return signature.rstrip("=")

```

error:

```auto
{
    "method": "join",
    "status": false,
    "result": "Invalid signature.",
    "errorMessage": "Signature is invalid.",
    "errorCode": 3712
}

```

Please help with this, thanks

---

<div class="post-metadata">

**Author:** ![j.schoenemeyer](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@j.schoenemeyer](https://devforum.zoom.us/u/j.schoenemeyer)\
**Post date:** [February 16, 2023, 8:47pm UTC](https://devforum.zoom.us/t/invalid-signature-python-3/83251/2 "2023-02-16T20:47:09Z")

</div>

the python 3 script in the documention creates a **JWT Signature** ,  
you need a **SDK JWT Signature** for the current version of meeting SDK

they are not compatible, [here](https://marketplace.zoom.us/docs/guides/build/jwt-app/jwt-app-migration/) are more information

you can easily distinguish the signature routines:

- JWT Signature (deprecated) → time in **Milliseconds**
- SDK JWT Signature → time in **Seconds**

there is no example implementation for SDK JWT Signature in python until now,  
but here is a [javascript version](https://github.com/zoom/meetingsdk-sample-signature-node.js/blob/master/index.js) - you have to translate it to python 3

---

<div class="post-metadata">

**Author:** ![jovy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jovy/32/55248_2.png) [@jovy](https://devforum.zoom.us/u/jovy)\
**Post date:** [February 20, 2023, 6:25am UTC](https://devforum.zoom.us/t/invalid-signature-python-3/83251/4 "2023-02-20T06:25:39Z")

</div>

Hi @j.schoenemeyer

I tried Javascript code provided in previous message. But when i test this code to generate signature, I’m keep getting error `mac key shall be specified for HS* alg`

 ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/9/b/9bb2e2c497acb928e02e7b25f8909997601eb03c.png)

below is code which I’m trying

```auto
app.post('/', (req, res) => {

  const iat = Math.round(new Date().getTime() / 1000) - 30;
  const exp = iat + 60 * 60 * 2

  const oHeader = { alg: 'HS256', typ: 'JWT' }

  const oPayload = {
    sdkKey: process.env.ZOOM_SDK_KEY,
    mn: req.body.meetingNumber,
    role: req.body.role,
    iat: iat,
    exp: exp,
    appKey: process.env.ZOOM_SDK_KEY,
    tokenExp: iat + 60 * 60 * 2
  }

  const sHeader = JSON.stringify(oHeader)
  const sPayload = JSON.stringify(oPayload)
  const signature = KJUR.jws.JWS.sign('HS256', sHeader, sPayload, process.env.ZOOM_SDK_SECRET)

  res.json({
    signature: signature
  })
})

```

can you please help with this?

---

<div class="post-metadata">

**Author:** ![jovy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jovy/32/55248_2.png) [@jovy](https://devforum.zoom.us/u/jovy)\
**Post date:** [February 20, 2023, 8:50am UTC](https://devforum.zoom.us/t/invalid-signature-python-3/83251/5 "2023-02-20T08:50:45Z")

</div>

Also, I have followed the code to generate a signature as described [here](https://marketplace.zoom.us/docs/sdk/native-sdks/web/signature/#jwt-signature-parameters), but still it shows the invalid signature

pls refer below code,

```auto
  const meetingNumber = req.body.meetingNumber;
  const role = req.body.role;

  const timestamp = new Date().getTime() - 30000
  const msg = Buffer.from(ZOOM_SDK_KEY + meetingNumber + timestamp + role).toString('base64')
  const hash = crypto.createHmac('sha256', ZOOM_SDK_SECRET).update(msg).digest('base64')
  const signature = Buffer.from(ZOOM_SDK_KEY, meetingNumber, timestamp, role, hash).toString('base64')

  res.json({
    code: 200,
    signature: signature
  })

```

here ZOOM\_SDK\_SECRET and ZOOM\_SDK\_KEY I have copied from Meeting SDK app we created on zoom developers account

output

```auto
{
    "code": 200,
    "signature": "ZGI1ZnkwN1ViclloUkFVR0V1NU9VbFJKSXZ6RE9Dam13bk0w"
}

```

 ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/f/6/f6db33eefee8945843565aed595fb108ef25864f.png)

---

<div class="post-metadata">

**Author:** ![j.schoenemeyer](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@j.schoenemeyer](https://devforum.zoom.us/u/j.schoenemeyer)\
**Post date:** [February 20, 2023, 1:16pm UTC](https://devforum.zoom.us/t/invalid-signature-python-3/83251/6 "2023-02-20T13:16:49Z")

</div>

you can check your signatur [here](https://jwt.io/)

but first you should try the [example on github](https://github.com/zoom/meetingsdk-web-sample)

the **CDN version** is ready to use with a few simple steps

```auto
CDN/js/index.js:20 var SDK_KEY = "YOUR_SDK_KEY";
CDN/js/index.js:26 var SDK_SECRET = "YOUR_SDK_SECRET";
CDN/js/index.js:112 ... "/meeting.html?" // replace '/' with './'

CDN/js/meeting.js:31 leaveUrl: "/index.html", // replace '/' with './'

```

**Update** : here is a tutorial on [youtube](https://www.youtube.com/watch?v=fMIXcLlBwZ0)

---

<div class="post-metadata">

**Author:** ![chunsiong.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/chunsiong.zoom/32/35488_2.png) [@chunsiong.zoom](https://devforum.zoom.us/u/chunsiong.zoom)\
**Post date:** [February 23, 2023, 8:29am UTC](https://devforum.zoom.us/t/invalid-signature-python-3/83251/7 "2023-02-23T08:29:33Z")

</div>

I’m doing something like this

```auto
#pip3 install pyjwt
import jwt
import hashlib
import hmac
import base64
import time
def generateSignature(data,secret):
    encoded_jwt = jwt.encode(data, secret, algorithm="HS256")
    return (encoded_jwt);
if __name__ == ' __main__':
    epoch_time = int(time.time())
    epoch_time_48hours_later=epoch_time+172800
    CLIENT_SECRET=""
    CLIENT_ID=""
    data = { "appKey": CLIENT_ID,
             "iat": epoch_time, 
             "exp": epoch_time_48hours_later, 
             "tokenExp": epoch_time_48hours_later,
             "mn":123412341234,
            "role":1
             
            }
    print (generateSignature(data,CLIENT_SECRET))

```

---

<div class="post-metadata">

**Author:** ![jovy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/jovy/32/55248_2.png) [@jovy](https://devforum.zoom.us/u/jovy)\
**Post date:** [February 24, 2023, 1:39am UTC](https://devforum.zoom.us/t/invalid-signature-python-3/83251/8 "2023-02-24T01:39:42Z")

</div>

Thanks @chunsiong.zoom I have made it work using the node server, I will try the python code that you have provided 😀

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [February 27, 2024, 5:16pm UTC](https://devforum.zoom.us/t/invalid-signature-python-3/83251/9 "2024-02-27T17:16:28Z")

</div>

Closed on February 27, 2024, 5:16pm UTC

This topic was automatically closed 368 days after the last reply. New replies are no longer allowed.